Privacy Policy

1. Introduction

‍

As a valued customer, we prioritize the confidentiality and security of the information we collect about you. At Oxford Home Lending, a division of Lower, LLC (“Oxford Home Lending,” “Company,” “we,” “our,” or “us”), we have implemented a comprehensive policy to safeguard your personal data. This policy applies to all aspects of our organization, including our employees and any other trade names associated with Oxford Home Lending and Lower, LLC.

This Privacy Policy describes how we collect, use, disclose, and protect your personal information in connection with the mortgage lending services we provide. This policy applies to prospective, current, and former customers and complies with applicable federal and state laws, including the Gramm-Leach-Bliley Act (GLBA), the Fair Credit Reporting Act (FCRA), the Telephone Consumer Protection Act (TCPA), the Homebuyers Privacy Protection Act, the Real Estate Settlement Procedures Act (RESPA), and applicable state privacy and data protection laws.

2. Our Privacy Pledge

• We do not sell or rent customer information. Period.
• We share customer information only with certain employees and with companies providing services on our behalf to fulfill your needs.
• We may share your personal information with non-affiliates as necessary to assist in your application and mortgage process.
• We may share information for marketing and/or joint marketing purposes, subject to your right to opt out.
• Our policy requires all employees and companies providing services on our behalf to keep customer information safe and comply with our information security requirements.
• Our privacy policy applies to potential customers as well as current and former customers.
• You may have additional privacy protections under applicable state laws. To the extent those state laws apply, we will comply with them when we share information about you.

3. Safeguarding Personal Information

• We have adopted policies and procedures designed to protect your personal information from unauthorized use or disclosure.
• We have implemented physical, electronic, and procedural safeguards to maintain confidentiality and integrity of the personal information in our possession and to guard against unauthorized access.
• Our policy is to permit employees to access your personal information only if they have a legitimate business purpose for using such information, such as administering, providing, or developing our products or services.
• Our policy requires employees to safeguard personal information about the consumers and customers we serve or have served in the past.
• We maintain an incident response plan for data breaches and will notify affected consumers and appropriate regulatory authorities as required by applicable state and federal law.
• You may have additional privacy protections under applicable state laws. To the extent those state laws apply, we will comply with them when we share information about you.
• We conduct regular security assessments, vulnerability testing, and employee training on data security practices.
• We encrypt sensitive personal information both in transit and at rest using industry-standard encryption protocols.

4. Information We Collect About You

At Oxford Home Lending, we gather information to better serve your financial needs, provide quality products and services, and meet legal and regulatory requirements. We treat all information in our possession as personal, even if you are no longer a customer. The data we collect may include, among other things:

•  Identifying information, such as your name, age, date of birth, address, phone number, email address, and Social Security number.
• Employment information, including employer name, job title, and length of employment.
• Financial information such as your income, assets, and liabilities, as well as information about your savings, investments, insurance, and business.
•  Credit information, including credit scores, credit history, and information from credit reporting agencies.
•  Property information related to the real estate transaction, including appraisal and title data.
• Demographic information, where permitted or required by law (e.g., for Home Mortgage Disclosure Act [HMDA] reporting).
•  Device and online activity information, including IP address, browser type, cookies, and interactions with our website and digital platforms.
•  Communications data, including call recordings, text messages, email correspondence, and chat transcripts with our loan professionals.

We typically collect this information through various channels including applications and other forms you complete, conversations with our loan professionals and representatives, our website, mobile applications, and digital platforms. We may also collect information from a wide range of other sources to process and/or underwrite your loan, including employers, attorneys, banks, lenders, title insurers, insurance companies, credit reporting agencies, government agencies, and online web applications.

5. How We Use Your Information

We use the personal information we collect for the following purposes:

• Processing and underwriting your mortgage loan application.
•  Servicing and administering your mortgage account.
• Communicating with you about your account, application status, and related services.
• Complying with legal and regulatory obligations, including HMDA,ECOA, and state licensing requirements.
•  Preventing, detecting, and investigating fraud, identity theft, and other illegal activities.
• Improving our products, services, and customer experience.
•  Marketing our products and services to you, subject to applicable consent requirements and your opt-out rights.
•  Responding to court orders, subpoenas, and other legal processes.
•  Reporting to credit bureaus and consumer reporting agencies.

6. How We Share Your Information

As part of our everyday business operations, financial companies often share customers’ personal information with third-party entities. Below is a summary of how Oxford Home Lending shares your information, and whether you can limit that sharing:

‍

‍

6a.Sharing with Service Providers and Regulators

We may disclose transactional and personal details to state and federal regulators and to third-party service providers that assist us with our business operations. These third parties may include, among others: title companies, appraisers, insurance companies, underwriting services, processing services, loan servicers, printing companies, software providers, data analytics providers, federal and state regulators, marketing services, credit reporting agencies, and purchasers of loans. Oxford Home Lending adheres to all applicable state and federal laws with respect to the sharing of information.

6b.Sharing with Affiliates

Oxford Home Lending may disclose your personal information to affiliated service providers, including Lower, LLC and its affiliated companies, to support our day-to-day business operations. We may also share personal data with our affiliates for marketing or joint marketing efforts. When sharing personal information, we may include your name, subject property information, transactional details (such as estimated closing date, loan status, and loan amount), and contact information. Our affiliates and third-party service providers are bound by confidentiality agreements prohibiting them from using personal information for purposes other than those specified or as required by law.

6c.Sharing with Non-Affiliates

Oxford Home Lending may share your personal information with non-affiliated financial service providers to support our day-to-day business operations, or for marketing or joint marketing purposes. Your personal information shared may include your name, subject property information, transactional details, and contact information.

Oxford Home Lending is prohibited from directly or indirectly disclosing your account number to any non-affiliated third party for marketing purposes.

Unless otherwise permitted by this policy, Oxford Home Lending may not disclose your nonpublic personal information to a non-affiliated third party unless:

• You were provided a privacy notice;
• You had the opportunity to opt out;
• You were allotted a reasonable opportunity to opt out; and
• You elected not to opt out.

7. Trigger Lead Protections & the Homebuyers Privacy Protection Act

The Home buyers Privacy Protection Act, signed into law on September 5, 2025, and effective March 5, 2026, addresses the practice of selling trigger leads -where credit bureaus sell your mortgage application data to other lenders without your consent.

Oxford Home Lending is committed to full compliance with this law. We do not purchase or use trigger leads to solicit consumers who have not provided their express consent. Under this law:

• Credit bureaus may only share your mortgage-related credit inquiry data if you explicitly opt in.
• Recipients of such data must be your current lender, loan servicer, or a company you already do business with.
• Any credit offer must be a genuine, pre-qualified offer - not merely a marketing contact.

If you have applied for a mortgage and are receiving unsolicited contacts from other lenders, you may opt out of pre-screened credit offers at OptOutPrescreen.com or register your phone number at DoNotCall.gov.

8. Telephone Consumer Protection Act (TCPA) Compliance

Oxford Home Lending is committed to compliance with the Telephone Consumer Protection Act (TCPA), as amended, and all applicable Federal Communications Commission (FCC) rules and orders. Our TCPA compliance program includes the following:

8a. Consent Requirements

• Prior Express Written Consent (PEWC): We obtain prior express written consent before sending marketing or telemarketing calls or text messages using an automatic telephone dialing system (ATDS) or artificial / prerecorded voice messages.
• Clear and Conspicuous Disclosure: All consent disclosures are clear, conspicuous, and identify Oxford Home Lending as the entity authorized to contact you.
•  Consent Not Required for Purchase: We clearly disclose that providing consent is not a condition of purchasing any product or service.
• Consent Records: We maintain detailed records of all consent obtained, including the date, time, method, and specific language of the consent disclosure.

8b. One-to-One Consent Standards

Although the FCC’s proposed one-to-one consent rule was vacated by the Eleventh Circuit Court of Appeals in January 2025 and the FCC subsequently reinstated the prior consent standard in August 2025, Oxford Home Lending voluntarily maintains heightened consent practices as a best practice:

• We obtain consent that specifically identifies Oxford Home Lending as the entity authorized to make contact.
• We do not rely on blanket consent obtained through third-party lead generators that authorize contact by multiple, unnamed sellers.
• We ensure that all marketing communications are logically and topically associated with the interaction that prompted the consumer’s consent.
• We regularly audit our lead generation partners and vendors for consent compliance.

8c. Consent Revocation

You may revoke your consent to receive automated calls or text messages at any time by any reasonable means, including:

• Replying “STOP,” “QUIT,” “END,” “REVOKE,” “OPT OUT,” “CANCEL,” or “UNSUBSCRIBE” in response to a text message.
• Calling us at (833) 920-2273.
• Emailing [email protected].
• Notifying any Oxford Home Lending employee verbally or inwriting.

We will honor your revocation request within ten (10) business days. Please note: The FCC’s consent revocation rule, which may require callers to treat a revocation for one type of communication as applicable to all future automated communications from that caller, has been extended to January 31, 2027. Oxford Home Lending will comply with this rule upon its effective date and encourages consumers to clearly communicate the scope of any revocation request.

8d. Do Not Call Compliance

• Oxford Home Lending maintains an internal Do Not Call (DNC) preference list.
• We comply with the National Do Not Call Registry and all provisions of the TCPA for all consumers.
• Do Not Call requests will be honored within thirty (30) days and will remain effective for at least five (5) years from the date of request.
• No telemarketing calls will be made to residential or cellular phone numbers that appear on Oxford Home Lending’s Do Not Call list or the National Do Not Call Registry.
• We extend DNC protections to text messages in accordance with the FCC’s clarification that DNC Registry protections apply to texts.

8e. Mobile Numbers & SMS/Text Messaging

When you provide your mobile number and consent to SMS/ text messaging programs, we do not share your mobile number with non-affiliated financial service providers for their marketing purposes. We do not use consumer phone numbers solely for lead generation on behalf of third parties. Standard message and data rates may apply. You may opt out of text messages at any time by replying STOP.

9. Marketing and Joint Marketing

At Oxford Home Lending, we aim to keep you informed about our new and existing products. To achieve this, we engage in direct marketing through various channels, including direct mailers, email, telephone, and digital advertising.

We may collaborate with other financial institutions and service providers under joint marketing agreements. These partnerships allow us to offer you additional services that enhance value. All joint marketing partners are bound by contractual obligations to safeguard your information.

If you wish to limit our internal or joint marketing efforts, please call us at (833) 920-2273 or [email protected].

10. Cookies and Digital Tracking Technologies

Oxford Home Lending may employ cookies and similar tracking technologies on our websites and digital platforms. We also collaborate with third-party vendors who use these technologies. These vendors are contractually bound to safeguard any data they collect on our behalf.

Cookies and tracking technologies we use may include:

• Essential cookies required for website functionality and security.
• Analytics cookies to understand how visitors interact with our website.
• Advertising and retargeting cookies used to deliver relevant advertisements.
• Third-party pixels and tags used for conversion tracking and marketing attribution.

If you wish to prevent information from being stored without your knowledge or consent, you can adjust your cookie settings in your browser. Beginning in 2026, Connecticut and Oregon join a growing number of states requiring recognition of Universal Opt-Out Mechanisms (such as Global Privacy Control signals) on websites. Oxford Home Lending will honor such signals as required by applicable law.

11. To Limit Our Sharing

To limit the sharing of your information (or opt out), as allowed by federal and state law, please reach out to us at:

• Phone: (833) 920-2273
• Email: [email protected]
• Website: [Insert Oxford Home Lending Privacy Policy URL]

We may begin sharing your information 30 days from the date we sent this notice unless you explicitly authorize us to start sharing immediately. Even after you are no longer our customer, we may continue to share your information as described in this notice. Feel free to contact us anytime to restrict our sharing.

If you limit sharing for an account that you jointly hold with someone else, your choices will apply to all account holders. Your request to limit sharing remains effective until you revoke it in writing or agree to revoke it electronically.

12. Your Rights Under Federal Law

Federal law gives you the right to limit the following:

• Sharing for Affiliates’ Everyday Business Purposes: This pertains to information related to your creditworthiness.
• Affiliates’ Marketing Use: You can prevent affiliates from using your information for marketing purposes.
•  Non-Affiliates’ Marketing: You have the right to limit sharing with non-affiliates for marketing purposes.

13. Your Data Rights

As an individual, you have certain rights regarding your personal data under applicable state and federal law:

• Access: You can request to see the specific pieces of data we hold about you. We will provide this information in a portable and easily accessible format.
• Deletion: You have the right to request the deletion of your data. While we are legally required to retain some information (such as records required under RESPA, TILA, ECOA, BSA/AML, and state licensing laws), we will delete everything we can in accordance with applicable law.
• Correction: You have the right to request that inaccurate personal databe corrected.
• Opt Out of Sale or Sharing: Where applicable under state law, you may opt out of the sale or sharing of your personal information for targeted advertising.
•  Non-Discrimination: We will not discriminate against you for exercising your data privacy rights.
• Third-Party Data: If we purchase data from a third party, we may re-acquire some information that has been deleted.

To exercise these rights, please contact us at (833)920-2273 or email [email protected]. We will respond to verified consumer requests within the timeframes required by applicable law.

14. State-Specific Privacy Provisions

California Residents

We will not share your information with companies outside of our company, except for our everyday business purposes, for marketing our products and services to you, or with your consent. California residents have additional rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), including the right to know, delete, correct, and opt out of the sale or sharing of personal information. We honor Global Privacy Control (GPC) signals as opt-out requests as required by the CCPA.

Vermont Residents

Vermont is an “opt-in” state. Non-public personal financial information may not be shared with others except as permitted by law unless the Vermont consumer specifically consents (“opts in”) to the disclosure. Vermont law also prohibits the sharing of credit reports and/or credit worthiness information with affiliates unless the consumer has opted in.

Connecticut Residents

Effective July 1, 2026, Connecticut’s amended Data Privacy Act (CDPA) will apply to non bank mortgage companies. Oxford Home Lending will comply with all applicable CDPA requirements for Connecticut residents, including honoring Universal Opt-Out Mechanisms and providing enhanced consumer data rights for non-GLBA-covered personal information.

Montana Residents

Montana’s amended data privacy law removes the GLBA entity-level exemption for independent mortgage banks effective 2026. Oxford Home Lending will comply with all applicable Montana data privacy requirements.

Indiana, Kentucky, and Rhode Island Residents

Comprehensive data privacy laws took effect in Indiana, Kentucky, and Rhode Island on January 1, 2026. Oxford Home Lending complies with the consumer data rights and data protection obligations under these laws to the extent they apply to our operations.

Other State Residents

State laws and individual companies may give you additional rights to limit sharing. Oxford Home Lending complies with all applicable state data privacy and consumer protection laws, including those in Colorado, Delaware, Iowa, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia. If you have questions about your state-specific rights, please contact us at (833) 920-2273.

15. Fair Credit Reporting Act (FCRA) Notice

This notice is provided to you in accordance with § 601 etseq. of the Federal Fair Credit Reporting Act (FCRA). In connection with processing your loan application, we will request a consumer credit report on your credit standing, credit capacity, and credit worthiness from a Consumer Reporting Agency.

If adverse action is taken on your loan application, we will advise you of the name, address, and telephone number of the Consumer Reporting Agency, and you will have the right to obtain within sixty (60) days of adverse action a free copy of the consumer credit report from the Consumer Reporting Agency. You also have the right to dispute the accuracy or completeness of any information in the credit report furnished.

Important Notice about Credit Reporting: We may report information about your account(s) to credit bureaus and/or consumer reporting agencies. Late payments, missed payments, or other defaults on your account(s)may be reflected in your credit report and/or consumer report.

16. Data Retention

Oxford Home Lending retains personal information for as long as necessary to fulfill the purposes for which it was collected, comply with legal and regulatory obligations, resolve disputes, and enforce our agreements. Specific retention periods include:

• Mortgage loan records: Retained for the life of the loan plus a minimum of three (3) years after payoff or transfer, or longer as required by applicable federal and state law.
• Application records (including denied applications): Retained for a minimum of twenty-five (25) months as required by ECOA / Regulation B.
• BSA/AML records: Retained for a minimum of five (5) years as required by the Bank Secrecy Act.
• HMDA data: Retained for a minimum of three (3) years.
• Communications and consent records: Retained for a minimum of five (5) years or as required by applicable law.

17. Data Breach Notification

In the event of a data breach involving your personal information, Oxford Home Lending will notify affected consumers and appropriate state and federal regulatory authorities in accordance with applicable data breach notification laws. We maintain an incident response plan and will provide timely notice consistent with the requirements of the jurisdiction(s) in which affected consumers reside.

18. Telephone Communications & Recording Disclosure

All telephone communications with Oxford Home Lending or our authorized agents may be monitored or recorded for quality control, training, and compliance purposes. By engaging in telephone communication with us, you acknowledge this practice. Where required by applicable state law, we will inform you of any recording at the out set of the call.

19. Changes to Our Privacy Policy

Our Privacy Policy undergoes regular reviews to ensure it aligns with data protection practices and complies with legal requirements. If we make any significant changes to how we manage your personal data, we will promptly notify you through our updated Privacy Policy posted on our website. Additionally, you can always reach out to us directly to receive a physical copy of the revised policy at (833) 920-2273.

20. Definitions

• Affiliates: Companies related by common ownership or control. They can be financial (such as mortgage companies or insurance companies) and nonfinancial companies (such as direct marketing companies, technology companies, and title companies). Lower, LLC and its affiliated entities are affiliates of Oxford Home Lending.
• Non-Affiliates: Companies not related by common ownership or control. They can be financial (such as mortgage companies, insurance companies, credit unions) and non-financial companies (such as direct marketing companies, technology companies, and credit reporting agencies).
• Joint Marketing: A formal agreement between non-affiliated financial companies that together market financial products or services to you.
• Opt-Out: A direction by you that the financial institution not disclose certain personal information about you to a non-affiliated third party, except as permitted by law.
• Cookies: Text files with small pieces of data used to identify and keep track of a website user’s visits and activity.
• Prior Express Written Consent (PEWC): A written agreement bearing the consumer’s signature that clearly and conspicuously authorizes the identified seller to deliver advertisements or telemarketing messages using an ATDS or artificial / prerecorded voice.
• Nonpublic Personal Information (NPI): Personally identifiable financial information provided by a consumer, resulting from a transaction with the financial institution, or otherwise obtained by the financial institution.
• Trigger Lead: Consumer credit inquiry data sold by credit bureaus to third-party lenders when a consumer applies for a mortgage, now restricted under the Home buyers Privacy Protection Act effective March 5, 2026.

21. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data rights, or need to submit a complaint, please contact us:

Oxford Home Lending

A Division of Lower, LLC

Phone: (833) 920-2273

Email:[email protected]

Opt-Out Email:[email protected]

Website: [Insert URL]

Mailing Address: [Insert Address]